Skip to content
Legacy docs for Tenzir v5.x. For the latest Tenzir v6 series, visit docs.tenzir.com. Migrating from v5? Read the Tenzir v6 migration guide.

Tenzir can read from and write to files. This includes non-regular files such as Unix domain sockets, standard input, standard output, and standard error.

UnixDomainSocketstdoutstdinstderrJSONPCAPCSVread(2)mmap(2)write(2)

When ~ is the first character in the file path, the operator substitutes it with the $HOME environment variable.

Use from_file to read files with glob patterns, automatic format detection, and file monitoring. For writing, use save_file with a print operator.

Read from a file and parse it in the format implied by the file extension:

from_file "/tmp/file.json"

The operator automatically decompresses the file when the suffix list contains a supported compression algorithm:

from_file "/tmp/file.json.gz"
from_file "/var/log/*.json"

Use watch=true to continuously monitor for new files:

from_file "/var/log/app/*.json", watch=true

Write to a file in a specific format:

version
print_json
save_file "/tmp/tenzir-version.json"

With compression:

version
print_json
compress_bz2
save_file "/tmp/tenzir-version.json.bz2"

In case the file exists and you do not want to overwrite it, pass append=true as option:

from {x: 42}
print_csv
save_file "/tmp/event.csv", append=true

Pass uds=true to signal that the file is a Unix domain socket:

print_ndjson
save_file "/tmp/socket", uds=true

When reading from a Unix domain socket, use from_file with a parsing pipeline:

from_file "/tmp/socket" {
read_ndjson
}

Last updated: